# MA-703.082018: MyCERT Alert - Cryptomining Issue

**Date:** 09 Aug 2018  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-703.082018  
**Advisory ID:** MA-703.082018

---

**1.0    Introduction**
Recently, MyCERT has received several incidents involving cryptocurrency java script mining tools embedded in vulnerable websites to secretly mine digital currency. These websites expand the user's Central Processing Unit (CPU) power without their permission.
Cryptocurrency mining occurs when malicious cyber actors exploit vulnerabilities in webpages, software, and operating systems to illicitly install cryptomining software on victim devices and systems. With the cryptomining software installed, the malicious cyber actors effectively hijack the processing power of the victims that browse the infected sites devices and systems to earn cryptocurrency. Based on the incidents received, we found mainly the servers are running unpatched softwares and applications, such as unpatched CMS. Based on the incidents we received, the cryptomining scripts found are Crypto-Loot, coinhive, PUA.JSCoinminer and PUA.WASMcoinminer
Digital Currency is a form of currency that exists only in digital form, unlike traditional physical currency such as banknotes and coins. Digital currency is digitally created, held and transacted electronically through transfers of value on computer networks. Digital currencies are generated by mining software that run on computer systems on the internet, making use of the computational power of the hardware Central Processing Unit (CPU) and Graphics Processing Unit (GPU). Bitcoin, Monero and Ethereum are examples of digital currencies that make use of hardware computational power for digital mining.
**2.0    Impact**
Additionally, malicious cyber actors may infect a website with cryptomining JavaScript code, which leverages a visitor’s processing power via their browser to mine cryptocurrency. Cryptojacking may result in the following consequences to victim devices, systems, and networks:
•    Degraded system and network performance because bandwidth and central processing unit (CPU) resources are monopolized by cryptomining activity;
•    Increased power consumption, system crashes, and potential physical damage from component failure due to the extreme temperatures caused by cryptomining;
•    Disruption of regular operations; and
•    Financial loss due to system downtime caused by component failure and the cost of restoring systems and files to full operation as well as the cost of the increased power consumption.
**3.0 Affected System and devices**
Any internet-connected device with a CPU is susceptible to cryptojacking. The following are commonly targeted devices:
•    **Computer systems and network devices** – including those connected to information technology and Industrial Control System networks;
•    **Mobile devices** – devices are subject to the same vulnerabilities as computers;
•    **Internet of Things devices** – internet-enabled devices (e.g., printers, video cameras, and smart TVs).
**4.0    Recommendation**  
MyCERT advise users and system administrators to follow cybersecurity best practices to protect their internet connected systems and devices against cryptojacking:
•    **Use and maintain antivirus software**. Antivirus software recognizes and protects a computer against malware, allowing the owner or operator to detect and remove a potentially unwanted program before it can do any damage.
•    **Keep software and operating systems up-to-date**. Install software updates so that attackers cannot take advantage of known problems or vulnerabilities.
•    **Use strong passwords*.** Select passwords that will be difficult for attackers to guess, and use different passwords for different programs and devices. It is best to use long, strong passphrases or passwords that consist of at least 16 characters
•    **Change default usernames and passwords**. Default usernames and passwords are readily available to malicious actors. Change default passwords, as soon as possible, to a sufficiently strong and unique password.
•    **Check system privilege policies**. Review user accounts and verify that users with administrative rights have a need for those privileges. Restrict general user accounts from performing administrative functions.
•    **Apply application whitelisting.** Consider using application whitelists to prevent unknown executables from launching autonomously.
•    **Be wary of downloading files from websites**. Avoid downloading files from untrusted websites. Look for an authentic website certificate when downloading files from a secure site.
•    **Recognize normal CPU activity and monitor for abnormal activity**. Network administrators should continuously monitor systems and educate their employees to recognize any above-normal sustained CPU activity on computer workstations, mobile devices, and network servers. Any noticeable degradation in processing speed requires investigation.
•    **Disable unnecessary services.** Review all running services and disable those that are unnecessary for operations. Disabling or blocking some services may create problems by obstructing access to files, data, or devices.
•    **Uninstall unused software**. Review installed software applications and remove those not needed for operations. Many retail computer systems with pre-loaded operating systems come with toolbars, games, and adware installed, all of which can use excessive disk space and memory. These unnecessary applications can provide avenues for attackers to exploit a system.
•    **Validate input**. Perform input validation on internet-facing web server and web applications to mitigate injection attacks. On web browsers, disable JavaScript execution. For Microsoft Internet Explorer, enable the cross-site scripting filter.
•    **Install a firewall.** Firewalls may be able to prevent some types of attack vectors by blocking malicious traffic before it can enter a computer system, and by restricting unnecessary outbound communications. Some device operating systems include a firewall. Enable and properly configure the firewall as specified in the device or system owner’s manual.
•    **Create and monitor blacklists**. Monitor industry reports of websites that are hosting, distributing, and being used for, malware command and control. Block the internet protocol addresses of known malicious sites to prevent devices from being able to access them.
Generally, MyCERT advises the users of this product to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#4a2933282f387373730a2933282f38392f293f38233e33642733) or [[email protected]](/cdn-cgi/l/email-protection#3c51455f594e487c51455f594e4812534e5b125145)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Handphone: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
•    <https://www.us-cert.gov/ncas/tips/ST18-002>
•    <https://www.csa.gov.sg/singcert/news/advisories-alerts/alert-on-browser-based-digital-currency-mining>
•    <https://www.csa.gov.sg/singcert/news/advisories-alerts/alert-on-digital-currency-mining-campaign-zealot>
•    <https://www.csoonline.com/article/3253572/internet/what-is-cryptojacking-how-to-prevent-detect-and-recover-from-it.html>
•    <https://coinsutra.com/cryptojacking/>